2
$\begingroup$

Dan Boneh's courersa lecture on format preserving encryption at 5.50 mins , talks about truncating a PRF on $n$ bits to PRF on $t$ bits.

The approach is by appending $(n-t)$ zeros to input $t$ bits then applying AES on $n$ bits and truncating it back to $t$ bits . He says there are better ways to do it but does not mention how . anybody has idea on better ways to truncating PRF on $t$ bits when $t \ll n$ .

$\endgroup$
  • $\begingroup$ Better, in what way? The construction Boneh provides is a perfectly reasonable choice. Unless you can define in what objective metric/criteria you would use to define "better", I don't think this question is well-defined. $\endgroup$ – D.W. Jun 23 '14 at 1:43
  • $\begingroup$ @D.W even i was not clear by Boneh's comment that there are better ways to do it . so thought of checking with the community $\endgroup$ – sashank Jun 23 '14 at 6:24